@eep The code in question is contained in a part of NodeBB that is currently being heavily refactored. I'll ask @psychobunny if this can be merged into his changes. However, as described in the github issue, doesn't this change the URL present in the browser? Having an escaped URL in the address bar really defeats the purpose of a pretty URL, imo...

Well an empty string shouldn't crash tag.content = tag.content.replace(/[&<>'"]/g, function(tag) { return escapeList[tag] || tag; }); Make sure you are on latest on both nodebb and the lavender theme. Are you still getting any crashes?